Short Integer Solution Research Articles

DiLizium: A Two-Party Lattice-Based Signature Scheme.

In this paper, we propose DiLizium: a new lattice-based two-party signature scheme. Our scheme is constructed from a variant of the Crystals-Dilithium post-quantum signature scheme. This allows for more efficient two-party implementation compared with the original but still derives its post-quantum security directly from the Module Learning With Errors and Module Short Integer Solution problems. We discuss our design rationale, describe the protocol in full detail, and provide performance estimates and a comparison with previous schemes. We also provide a security proof for the two-party signature computation protocol against a classical adversary. Extending this proof to a quantum adversary is subject to future studies. However, our scheme is secure against a quantum attacker who has access to just the public key and not the two-party signature creation protocol.

Efficient Multi-Signature Scheme Using Lattice

Abstract With the help of a multi-signature scheme, we can reduce the cost of storage and bandwidth in case of many signers signing the same message. Therefore, multi-signature schemes can be used in bitcoin to reduce the size of a blockchain. In this paper, we propose a lattice-based multi-signature scheme with the following highlighted features. Our lattice-based multi-signature scheme supports signature compression and public key aggregation. The only existing lattice-based multi-signature scheme by Kansal and Dutta (Africacrypt, 2020) that supports both signature compression and public key aggregation has communication and storage cost $\widetilde{\mathcal{O}}(n^2)$, whereas our communication and storage cost is $\mathcal{O}(n)$. Our multi-signature scheme is in the plain public key model where the special registration of the public key is not necessary and it is secure under the rogue key attack. Our multi-signature scheme is secure under the hardness of ring short integer solution problem in the random oracle model.

Bi-GISIS KE: Modified key exchange protocol with reusable keys for IoT security

We propose a new bilateral generalization inhomogeneous short integer solution (Bi-GISIS)-based key exchange protocol with reusable key feature for post-quantum IoT security. It is aimed to reduce the time consumption in the key generation of key exchange protocols to be used in IoT devices. To obtain reusable key, we define modified bilateral pasteurization in the random oracle model. By ensuring reusable keys, the same key becomes available in several executions of the proposed protocol. This feature allows efficient usage of reusable keys in resource-constrained IoT architectures. The proposed scheme is suitable for quantum secure key exchange in D2D-aided fog computing environment. A key exchange protocol with improved key management process is constructed for D2D.

Lattice-based signcryption with equality test in standard model

A signcryption, which is an integration of a public key encryption and a digital signature, can provide confidentiality and authenticity simultaneously. Additionally, a signcryption associated with equality test allows a third party (e.g., a cloud server) to check whether or not two ciphertexts are encrypted from the same message without knowing the message. This application plays an important role especially in computing on encrypted data. In this paper, we propose the first lattice-based signcryption scheme equipped with a solution to testing the message equality in the standard model. The proposed signcryption scheme is proven to be secure against insider attacks under the learning with errors assumption and the intractability of the short integer solution problem. As a by-product, we also show that some existing lattice-based signcryptions either is insecure or does not work correctly.

Identity-Based Linkable Ring Signatures From Lattices

Linkable ring signatures is a useful cryptographic tool for constructing applications such as ones relative to electronic voting (e-voting), digital cashes (e-cashes) as well as cloud computing. Equipped with linkable ring signatures, e-voting, e-cash systems can simultaneously enjoy the privacy and the unreusability properties thanks to the anonymity and the linkability of linkable ring signatures. Likewise, cloud servers can enjoy a privacy-preserving ability, a flexible access control and an efficient security management with linkable ring signatures. Moreover, linkable ring signatures built in the identity-based setting would help to remove the expense of using the conventional public key infrastructure and also could be applied to the user management. This primitive hence would be suitable for huge-scale applications. In this paper, we present the first identity-based linkable ring signatures (IdLRS) in both integer lattice and ideal lattice setting. The proposed IdLRS is proved secure in the random oracle model and based on the hardness of the short integer solution and ring short integer solution assumption. We also implement the proposed idLRS as a proof of concept and then do some experiments to evaluate the running times and the sizes.

Improved Reduction Between SIS Problems Over Structured Lattices

Many lattice-based cryptographic schemes are constructed based on hard problems on an algebraic structured lattice, such as the short integer solution (SIS) problems. These problems are called ring-SIS (R-SIS) and its generalized version, module-SIS (M-SIS). Generally, it has been considered that problems defined on the module lattice are more difficult than the problems defined on the ideal lattice. However, Koo, No, and Kim showed that R-SIS is more difficult than M-SIS under some norm constraints of R-SIS. However, this reduction has problems in that the rank of the module is limited to about half of the instances of R-SIS, and the comparison is not performed through the same modulus of R-SIS and M-SIS. In this paper, we propose that R-SIS is more difficult than M-SIS with the same modulus and ring dimension under some constraint of R-SIS. Also, we show that R-SIS with the modulus prime q is more difficult than M-SIS with the composite modulus c, such that c is divided by q. In particular, it shows that through the reduction from M-SIS to R-SIS with the same modulus, the rank of the module is extended as much as the number of instances of R-SIS from half of the number of instances of R-SIS. Finally, this paper shows that R-SIS is more difficult than M-SIS under some constraints, which is tighter than the M-SIS in the previous work.

Traceable Signatures using Lattices

Traceable Signatures is an extension of group signatures that allow tracing of all signatures generated by a particular group member without violating the privacy of remaining members. It also allows members to claim the ownership of previously signed messages. Till date, all the existing traceable signatures are based on number-theoretic assumptions which are insecure in the presence of quantum computers. This work presents the first traceable signature scheme in lattices, which is secure even after the existence of quantum computers. Our scheme is proved to be secure in the random oracle model based on the hardness of Short Integer Solution and Learning with Errors

Lattice-based group signature scheme without random oracle

ABSTRACT Group signature is a cryptographic primitive where any member can anonymously sign a message on behalf of the population they belong to. Several group signatures were proposed based on number-theoretic assumptions. All these schemes are insecure in the presence of quantum computers. Group signatures based on lattice assumptions are believed to be quantum-resistant. In the past few years, group signatures based on lattice assumptions have been proposed and most of them are proved to be secure in random-oracle model. This paper presents a lattice-based group signature scheme without using random-oracle. Our scheme is based on correlation-intractable function ensembles for all evasive relations which are constructed recently based on well-defined assumptions. Security of our scheme is proved based on correlation-intractable function ensembles and hardness of Short Integer Solution and Learning With Errors problem.

Reduction From Module-SIS to Ring-SIS Under Norm Constraint of Ring-SIS

Lattice-based cryptographic scheme is constructed based on hard problems on a lattice such as the short integer solution (SIS) problem and the learning with error (LWE). However, the cryptographic scheme based on SIS or LWE is inefficient since the size of the key is too large. Thus, most cryptographic schemes use the variants of LWE and SIS with ring and module structures. Albrecht and Deo showed that there is a reduction from module-LWE (M-LWE) to ring-LWE (R-LWE) in the polynomial ring by handling the error rate and modulus. However, unlike the LWE problem, the SIS problem does not have an error rate, but there is the upper bound β on the norm of the solution of the SIS problem. In this paper, we propose the two novel reductions related to module-SIS (M-SIS) and ring-SIS (R-SIS) on a polynomial ring. We propose (i) the reduction from R-SIS q k ,m k ,β k to R-SIS q , m,β and (ii) the reduction from M-SIS to R-SIS under norm constraint of R-SIS. Combining these two results implies that R-SIS for a specified modulus and number samples is more difficult than M-SIS under norm constraints of R-SIS, which provides the range of possible module ranks for M-SIS. From the reduction we propose, contrary to the widely known belief, our result shows that there is a possibility that the security parameters of M-SIS may be less secure when it reduces to R-SIS for the theoretical reasons presented in this paper. Therefore, when generating parameters on an M-SIS structure, the theoretical security level over R-SIS also should also be checked at the same time.

Privacy Protection of VANET Based on Traceable Ring Signature on Ideal Lattice

With the development of the Vehicular Ad-Hoc Network (VANET), protecting user privacy while ensuring security has become an immense challenge. A ring signature has the characteristics of no manager and unconditional anonymity, which can substantially protect user privacy. However, two problems exist in practical applications: first, unconditional anonymity cannot track the signer, which has potential security risks; and second, ordinary ring signatures cannot resist quantum attacks. In response to these problems, this paper proposes a Traceable Ring Signature (TRS) scheme on ideal lattice. In the scheme, the traceability of the ring signature is achieved by adding information to the ring signature. Selecting the algorithm on the ideal lattice to generate the master key can effectively resist quantum attacks. The scheme gives a detailed security proof and efficiency analysis. The new scheme has strong unforgeability for the difficult problem of Short Integer Solution (SIS) Question and a smaller signature size.

Implementing confidential transactions with lattice techniques

The notion of confidential transactions plays a central role in ensuring the confidentiality of transaction amounts in a block-chain-based cryptocurrency. Past researches have confirmed that the access policy of transaction amounts influences the anonymity of a cryptocurrency. Most of the current techniques of confidential transactions are based on the discrete logarithm problem. Because of the threats from quantum algorithms, clients are eager to enjoy security guarantees in a post-quantum scenario. Lattices are an ideal source of hardness, due to its exclusive worst-case to the average-case phenomenon. Nevertheless, the distinctions between the discrete logarithm problem and lattice problems build an obstacle in the way of borrowing the ideas from the former to the latter directly. In this study, inspired by the notion of commitments to polynomials and zero-knowledge arguments of knowledge for the inhomogeneous short integer solution problem, the authors give an approach to implement confidential transactions using lattice techniques.

A New Constant-Size Group Signature Scheme From Lattices

A lattice-based group signature scheme (LGSS) is an active cryptographic primitive, where each group member can sign messages anonymously in the name of the entire group and each valid signature should be traced to some group member on the lattice. In each LGSS, the size of the group signature usually depends on the number of group members and the security parameter. Thus, designing a constant-size LGSS is an interesting problem. At PKC 2018, Ling, Nguyen, Wang and Xu presented the first constant-size group signature scheme under lattice assumptions. Its design is based on a zero-knowledge argument of the knowledge of a valid message-signature pair for the Ducas-Micciancio signature scheme, which follows the sign-then-encrypt-then-prove protocol. In contrast to this work, we construct a new constant-size LGSS. The scheme adopts the sign-hybrid-encrypt approach and makes use of the Lyubashevsky signature scheme. Our work is efficient in the signing algorithm, more precise on the open algorithm and shorter in public key, secret key and signature size than previous studies. Furthermore, we prove that the scheme has full anonymity and full traceability under the Ring Learning With Errors and Ring Short Integer Solution assumptions in the random oracle model.

LCPPA: Lattice‐based conditional privacy preserving authentication in vehicular communication

AbstractVehicular ad hoc network (VANET) plays an extremely important role in intelligent transportation systems. It enables vehicles equipped with smart devices to communicate with vehicles or available road side units or infrastructure. It has been observed that the security of data and privacy of user are two key challenges for vehicular communication to enable sharing of resources among unfamiliar vehicles. The existing classical cryptography‐based schemes are not secure in the quantum computing world due to Shor's algorithm. To address the challenges in post‐quantum era, we have presented a framework based on short integer solution problem in some lattice that attains all effective identification and authenticity of the user to get authorized access, along with revocation to services. The integrity of proposed framework ensures that information is accurate and can be trusted. This paper ensures conditional autonomous driving and efficient vehicular traffic flow in a VANET. As a result, the presented protocol is suitable for practical applications even in the post‐quantum environment, which can be utilized for reliable vehicular communication.

Modular lattice signatures, revisited

In this paper we revisit the modular lattice signature scheme and its efficient instantiation known as pqNTRUSign. First, we show that a modular lattice signature scheme can be based on a standard lattice problem. The fundamental problem that needs to be solved by the signer or a potential forger is recovering a lattice vector with a restricted norm, given the least significant bits. We show that this problem is equivalent to the short integer solution (SIS) problem over the corresponding lattice. In addition, we show that by replacing the uniform sampling in pqNTRUSign with a bimodal Gaussian sampling, we can further reduce the size of a signature. An important new contribution, enabled by this Gaussian sampling version of pqNTRUSign, is that we can now perform batch verification of messages signed by the same public key, which allows the verifier to check approximately 24 signatures in a single verification process.

Group signature from lattices preserving forward security in dynamic setting

<p style='text-indent:20px;'>We propose the <i>first</i> lattice-based dynamic group signature scheme achieving <i>forward security</i>. Our scheme is proven to be secure against framing attack, misidentification attack and preserves anonymity under the learning with errors (${\mathsf{LWE}}$) and short integer solution (${\mathsf{SIS}}$) assumptions in the random oracle model. More interestingly, our setting allows the group manager to generate distinct certificates to distinct users which can be updated by the users themselves without any interaction with the group manager. Furthermore, our scheme is dynamic where signing key of a user is not fixed during the setup and is issued only at the joining time of the user.

More efficient, provably-secure direct anonymous attestation from lattices

Abstract The Cloud-Edges (CE) framework, wherein small groups of Internet of Things (IoT) devices are serviced by local edge devices, enables a more scalable solution to IoT networks. The trustworthiness of the network may be ensured with Trusted Platform Modules (TPMs). This small hardware chip is capable of measuring and reporting a representation of the state of an IoT device. When connecting to a network, the IoT platform might have its state signed by the TPM in an anonymous way to prove both its genuineness and secure state through the Direct Anonymous Attestation (DAA) protocol. Currently standardised DAA schemes have their security supported on the factoring and discrete logarithm problems. Should a quantum-computer become available in the next few decades, these schemes will be broken. There is therefore a need to start developing a post-quantum DAA protocol. This paper presents a Lattice-based DAA (LDAA) scheme to meet this requirement. The security of this scheme is proved in the Universally Composable (UC) security model under the hardness assumptions of the Ring Inhomogeneous Short Integer Solution (Ring-ISIS) and Ring Learning With Errors (Ring-LWE) problems. Compared to the only other DAA scheme with conjectured post-quantum security available in related art, the storage requirements of the TPM are reduced twofold and the signature sizes 5 times. Moreover, experimental results show that the signing and verification operations are accelerated 1.1 and 2.0 times, respectively.

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

Lattice-based group signature is an active research topic in recent years. Since the pioneering work by Gordon et al. (2010) [20], eight other schemes have been proposed, providing various improvements in terms of security, efficiency and functionality. However, most of the existing constructions work only in the static setting where the group population is fixed at the setup phase. The only two exceptions are the schemes by Langlois et al. (2014) [27] that handles user revocations (but new users cannot join), and by Libert et al. (2016) [28,29] which addresses the orthogonal problem of dynamic user enrollments (but users cannot be revoked).In this work, we provide the first lattice-based group signature that offers full dynamicity (i.e., users have the flexibility in joining and leaving the group), and thus, resolve a prominent open problem posed by previous works. Moreover, we achieve this non-trivial feat in a relatively simple manner. Starting with Libert et al.'s fully static construction (2016) [30] - which is arguably the most efficient lattice-based group signature to date, we introduce simple-but-insightful tweaks that allow to upgrade it directly into the fully dynamic setting. More startlingly, our scheme even produces slightly shorter signatures than the former, thanks to an adaptation of a technique proposed by Ling et al. (2013) [35], allowing to prove inequalities in zero-knowledge. The scheme satisfies the strong security requirements of Bootle et al.'s model (2016) [7], under the Short Integer Solution (SIS) and the Learning With Errors (LWE) assumptions.Furthermore, we demonstrate how to equip the obtained group signature scheme with the deniability functionality in a simple way. This attractive functionality, put forward by Ishida et al. (2016) [22], enables the tracing authority to provide an evidence that a given user is not the owner of a signature in question. In the process, we design a zero-knowledge protocol for proving that a given LWE ciphertext does not decrypt to a particular message.

Zero-knowledge arguments for matrix–vector relations and lattice-based group encryption

Group encryption (GE) is the natural encryption analogue of group signatures in that it allows verifiably encrypting messages for some anonymous member of a group while providing evidence that the receiver is a properly certified group member. Should the need arise, an opening authority is capable of identifying the receiver of any ciphertext. As introduced by Kiayias, Tsiounis and Yung (Asiacrypt'07), GE is motivated by applications in the context of oblivious retriever storage systems, anonymous third parties and hierarchical group signatures. This paper provides the first realization of group encryption under lattice assumptions. Our construction is proved secure in the standard model (assuming interaction in the proving phase) under the Learning-With-Errors (LWE) and Short-Integer-Solution (SIS) assumptions. As a crucial component of our system, we describe a new zero-knowledge argument system allowing to demonstrate that a given ciphertext is a valid encryption under some hidden but certified public key, which incurs to prove quadratic statements about LWE relations. Specifically, our protocol allows arguing knowledge of witnesses consisting of X∈Zqm×n, s∈Zqn and a small-norm e∈Zm which underlie a public vector b=X⋅s+e∈Zqm while simultaneously proving that the matrix X∈Zqm×n has been correctly certified. We believe our proof system to be useful in other applications involving zero-knowledge proofs in the lattice setting.

Identity-Based Blind Multisignature From Lattices

Blind multisignature (BMS), first introduced by Horster et al , constitutes a crucial primitive that allows a user to generate a signature of a message from multiple signers, while the signers cannot obtain any information about the message. With these useful properties, blind multisignature is suitable for electronic payments and electronic voting. However, most of the current BMS schemes may be attacked by quantum computers in the future because they are based on traditional number theories, such as discrete logarithm assumption and large integer factor assumption. In this work, we first formalize the notion and the sound security models of the identity-based blind multisignature scheme (IDBMS). Then we present an instantiation based on lattices, along with rigorous proofs of the blindness and unforgeability under the lattice hard assumption (short integer solution, SIS), which is considered to remain secure under quantum computer attacks. To the best of our knowledge, it is the first identity-based quantum-resistant scheme that has the advantages of blind signature and multisignature.

Efficient Certificate-Based Signature with Short Key and Signature Sizes from Lattices

Certificate-based cryptography (CB-PKC) is an attractive public key setting, which reduces the complexity of public key infrastructure in traditional public key settings and resolves the key escrow problem in ID-based public key settings. In the past, a large number of certificate-based signature and encryption schemes were proposed. Nevertheless, the security assumptions of these schemes are mainly relied on the difficulties of the discrete logarithm and factorization problems. Unfortunately, both problems will be resolved when quantum computers come true in the future. Public key cryptography from lattices is one of the important candidates for post-quantum cryptography. However, there is little work on certificate-based cryptography from lattices. In the paper, we propose a new and efficient certificate-based signature (CBS) scheme from lattices. Under the short integer solution (SIS) assumption from lattices, the proposed CBS scheme is shown to be existential unforgeability against adaptive chosen message attacks. Performance comparisons are made to demonstrate that the proposed CBS scheme from lattices is better than the previous lattice-based CBS scheme in terms of private key size and signature size.